PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45951 Linux CVE debrief

A use-after-free vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem has been resolved. The issue affected the `check_pseudo_btf_id()` function, where incorrect reference counting could lead to a use-after-free condition on BTF (BPF Type Format) objects. Specifically, the `__check_pseudo_btf_id()` function could be invoked with a BTF object having a zero refcount, creating a potential memory safety vulnerability. The fix corrects the refcounting logic and patches related code accordingly. This vulnerability was addressed through multiple patch iterations, with v2 specifically fixing a refcount leak introduced in v1, and v3 rephrasing a comment for clarity.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux system administrators, kernel maintainers, security teams operating containerized environments with BPF workloads, and organizations relying on eBPF-based observability or security tools

Technical summary

The vulnerability exists in the BPF subsystem's BTF object handling. The `check_pseudo_btf_id()` function had incorrect reference counting logic that could pass a zero-refcount BTF object to `__check_pseudo_btf_id()`, resulting in a use-after-free condition. The fix corrects the refcounting implementation and addresses related code paths. Multiple stable kernel branch commits are provided to address this issue across supported kernel versions.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the referenced stable branch commits when available from your Linux distribution
  • Verify kernel version includes fixes for CVE-2026-45951 in BPF subsystem
  • Review systems utilizing BPF/BTF functionality for unusual behavior
  • Monitor distribution security advisories for kernel package updates
  • Consider restricting unprivileged BPF access via `kernel.unprivileged_bpf_disabled` sysctl as a defense-in-depth measure until patches are applied

Evidence notes

The vulnerability description indicates a use-after-free condition in BPF BTF object handling. The fix involved correcting refcounting in `check_pseudo_btf_id()` and `__check_pseudo_btf_id()`. Multiple kernel stable branch commits are referenced, suggesting backports to supported kernel versions. The iterative patch development (v1-v3) indicates careful review of the refcounting fix to avoid introducing memory leaks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45951 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45951

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45951 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45951

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9ff46ffeecdb1802d6e26183177935b948a12e7f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ccd2d799ed4467c07f5ee18c2f5c59bcc990822c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/eac65c272f3b49021a843cba5107d63627395e0e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.